0

Recently I have observed strange behaviour. At certain times, on certain web pages, if I click anywhere in the page a tab/popup opens with ads.

First I thought some Chrome extension might be doing it. Then I observed the same behaviour once or twice in the iPhone Safari browser, connected to the same WiFi network.

I couldn't figure out what might be the source of this malware.

Following is the screenshot of such an adware. I am one of the developers of this site and there is no code which pops up this ad! I have also observed the same adware on the https://underscorejs.org/ website few months ago.

Screenshot of Adware popup

EDIT 10 Aug 2018:

I found a few more details. I observed chrome dev tools that some special cookies are being set which tracks of add details.

Here are cookies details

Name: GL_GI2 
Content: eJw9i80KgkAYRafRLI2CC75GhiG67mcjymx8AJn0Q4bEGdRFvn2Z0e6ew7mMMe574MpgH4ZJcI6SIIyDKIbVkAZPBZyeGqU78OyC3bLLSteEdSqOH2dXapywyWT%2FlK2EO%2BMSeHPw05YaDOxrIXK4HY3lYIhquDf5aOl0L3Ic%2FvZ7dlbYqqE0vX5NDnsDnrkt2g%3D%3D
Domain: decademical.com
Expire: 2018-08-11T10:54:54.734Z


Name: GL_UI
Content: eJw9jb1ugzAYRYkJhDYK0pV4AB4hiesGxqpz1aFLN%2FSB7YQW%2BCLb%2FXv7Wh263HuGI50kSUS1RfpBCvWpsaRlK4%2BtHqy06mibZuhJ3Slr5EG1uBl9F6ifTFgj6x0teodsZm2mHTa94y9vXJVivdBskD9eHMfPZnpjB3F%2FijguEVd7CPZVWuYonmion1%2Fq17KAOOzL27gS2%2BtEwbKbu1HnAtnZkTZYPaAYKJgzux9stPHvga8AT7r79%2F%2FKKftv5Np8jkPMc7gY9wvOET7Q
Domain: decademical.com


Name: glx_pp_6922_201813106
Content: {"unload_time":1533898446,"loaded_time":1533898494,"click_num":1,"last_fired_time":1533898502,"last_fired_click_num":1,"pop_count":1}
Domain: actual server

On second ad run
{"unload_time":1533898845,"loaded_time":1533898494,"click_num":2,"last_fired_time":1533898811,"last_fired_click_num":2,"pop_count":2}

Ad link: http://eyelk.asikol.space/AwGN4beM8OWuzuKSlBpN9O-NZYk3UlcNaezbNeYqCieDHrHC_pbybl-LDimE9wNvfVGvWLLrDwMcjtoVTQbXswcsFIqiAn54oKkEVWFJndHO1A==?fgpymyn=AwHhIO8IaCOI49EVKpE8ks7a2hgiHREIaZ0kBxaUVREVagW40G9Zf-CoJ49EkB7rfkji4Vy2bFVx7vekUCU5lxGUO8cZaExCqtiXjJQZB9ri-McX3CKOthishYn_FgfwpanP9uYIPZEcvEcwKufTgD-xZigeUw1EvV5_Q_bJ6J7anbSK2uK3d11CKurZQlDNQeG0uuZDDBQ6q9JJOw58MOCZ8CiKYlcgI44UTOeAaDtIZnsTaKFi9pTzD3R1NTbO4s7Lhji55sL0Mo65qRKD7XBG

9
  • Besides WiFi hijack , this can be some sort of malvertisement that make use of the tracking cookies(you mention "certain site certain page").
    – mootmoot
    Aug 9, 2018 at 14:15
  • What router are you using for your (I suppose) home network? I heard about some routers doing this. Can you check, if this behaviour can be observed on a device, which is capable of using a different internet access? If it continues, leave your home network and try using the other access method. Does it still continue? Just trying to locate the source. Something seems to intercept your traffic. Are HTTPS sites affected?
    – GxTruth
    Aug 10, 2018 at 6:50
  • @GxTruth WiFi Router is TP-Link C20i and Modem is Gpon ONT. Sure will try to see if this behaviour could be found in other network with same device. I remember seeing this pop up in one of the HTTPS sites.
    – Anji
    Aug 10, 2018 at 10:51
  • Maybe you just have the same malware on both your PC/laptop and iPhone? There are a lot of possibilities. As you see from the comments and answer, there is a lot of guesswork involved that doesn't really lead to a credible answer.
    – Tom K.
    Aug 10, 2018 at 11:21
  • Looks like this cookie is getting set when I use internet from WiFi Router!!! Now reset the router?
    – Anji
    Aug 10, 2018 at 11:29

2 Answers 2

1

I would suggest to look into your network configuration. That sounds like someon is intercepting your traffic. Maybe your DNS entry was changed by another user of the wifi. Check this by going into your router configuration and look if your DNS Server isn't the router or your hosting Provider. If you are not sure what´s your DNS name use 8.8.8.8 for testing purposes. This is the google DNS server

It seems that another PC or device routes you to this sites. Is the same behavior on https sites or are you always routed to http?

4
  • I checked DNS. It points to 8.8.8.8 and 8.8.4.4 I am not always routed to HTTP. Usually, the most site I visit is HTTPS. I observed it in HTTPS as well at underscore.org.
    – Anji
    Aug 9, 2018 at 13:18
  • Did you also check the DNS entry on your phone and PC? If you are using an IPhone navigate to the WLAN Settings and press the I next to your connected WLAN. Check if the DNS Entry there is pointing to the Same address as your router.
    – Cyberduck
    Aug 9, 2018 at 13:20
  • iPhone is using the default DNS of WiFi router. i.e 8.8.8.8 / 8.8.4.4
    – Anji
    Aug 10, 2018 at 10:52
  • Try to use tracertin the windows CMD and look how the ping hops to another website. Use one website where the ad pops up. Especially look if it hops between your router and pc to another device.
    – Cyberduck
    Aug 10, 2018 at 13:09
1

Anji you are probably living in India using BSNL. BSNL has this problem also listed on here. Block these two addresses by either:

Hosts Method:

Add these two lines in hosts file.

127.0.0.1 decademical.com 127.0.0.1 mutualvehemence.com

URL Filter Method

EDIT : Even Airtel has been affected by same issue. Check here

3
  • can you edit your question to include these details?
    – schroeder
    Nov 26, 2018 at 20:12
  • i'm also facing the same problem.. If i kept webpage idle sometime for reading the click on any text selection. it opens a new ad tab... i'm on bsnl network.. So what this thing is called ? clickjacking ? or the complete network of my ISP is infected ?
    – Abhigyan
    Feb 12, 2019 at 14:00
  • Abhigyan our ISP is knowingly doing this. You also get some BSNL Offer Banner sometimes. Now a new IP does this (instead of the ones I mentioned) and when I WHOIS this IP, it shows address of some NS Cell BSNL Delhi.
    – demberto
    Feb 13, 2019 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .